Configuring Nd Attack Defense; Overview; Nd Attack Defense Configuration Task List; Enabling Source Mac Consistency Check For Nd Messages - HPE FlexNetwork 10500 Series Security Configuration Manual

Configuring ND attack defense

Overview

IPv6 Neighbor Discovery (ND) attack defense is able to identify forged ND messages to prevent ND
attacks.
The IPv6 ND protocol does not provide any security mechanisms and is vulnerable to network
attacks. An attacker can send the following forged ICMPv6 messages to perform ND attacks:
•
Forged NS/NA/RS messages with an IPv6 address of a victim host. The gateway and other
hosts update the ND entry for the victim with incorrect address information. As a result, all
packets intended for the victim are sent to the attacking terminal.
•
Forged RA messages with the IPv6 address of a victim gateway. As a result, all hosts attached
to the victim gateway maintain incorrect IPv6 configuration parameters and ND entries.
For information about the IPv6 ND protocol, see Layer 3–IP Services Configuration Guide.
Table 25 ND attack defense features at a glance
ND attack defense feature
Source MAC consistency check
ND attack detection
RA guard

ND attack defense configuration task list

Tasks at a glance
(Optional.)

Enabling source MAC consistency check for ND messages

(Optional.) Configuring ND attack detection
(Optional.) Configuring RA guard
Enabling source MAC consistency check for ND
messages
The source MAC consistency check feature is typically configured on gateways to prevent ND
attacks.
This feature checks the source MAC address and the source link-layer address for consistency for
each arriving ND message.
•
If the source MAC address and the source link-layer address are not the same, the device
drops the packet.
•
If the addresses are the same, the device continues learning ND entries.
To block
ND messages in which the Ethernet frame header and the source
link-layer address option of the ND message contain different source
MAC addresses.
ND messages in which the mapping between the source IPv6 address
and the source MAC address is invalid.
RA messages incompliant with the RA guard policy or identified to be
sent from hosts.
(applicable to access devices)
(applicable to Layer 2 access devices)
531
(applicable to gateways)